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I.  Introduction 


Spread-spectrum  (SS)  steganography  is  attracting  increasing  interest  among  researchers  and 
practitioners  in  the  helds  of  authentication  and  covert  communications.  Under  a  blind  host 
medium  scenario,  that  is  when  the  original  clean  host  is  assumed  to  be  unavailable,  past  works 
focused  on  the  detection  of  the  presence  of  a  known  message  as  in  [1],  [2],  the  recovery  of  an 
unknown  message  embedded  with  a  known  signature  as  in  [3],  [4],  or  system  optimization  for 
covert  message  delivery  to  signature-aware  recipients  [5]- [7]. 

Yet,  one  challenging  issue  in  SS  data  hiding  applications  is  fully  blind  message  recovery,  that 
is  when  little  or  nothing  can  be  assumed  about  the  embedded  message,  the  embedding  signature, 
and  the  host  image,  with  direct  application  to  eavesdropping  the  communication  of  an  enemy. 
Moreover,  fully  blind  message  recovery  is  also  of  interest  when  the  communication  takes  place 
between  allies,  since  it  is  bandwidth  efficient  and  requires  no  prior  agreement  on  the  message  to 
be  sent,  its  signature,  the  stego-key,  or  a  training  sequence. 

In  a  single  or  superimposed  signal  in  additive  white  Gaussian  noise  (AWGN)  scenario  one 
might  split  the  two  subspaces  spanned  by  the  signal  and  the  noise  eigenvectors,  respectively  [18]. 
However,  when  the  message  of  interest  and  its  total  disturbance  he  in  the  same  subspace  and  the 
message  signal  components  cannot  be  distinguished  by  subspace  estimation  techniques,  or  when 
subspace  tracking  is  dubious,  blind  signal  separation  and  estimation  is  usually  achieved  through 
iterative  procedures  that  take  advantage  of  the  finite  alphabet  property  arising  from  the  digital 
nature  of  the  hidden  data  and — when  applied  to  multiple  input  channels — the  independence  of 
the  signals  to  be  separated. 

Throughout  the  course  of  our  research,  we  attempt  to  recover  a  hidden  unknown  message 
when  neither  the  original  host  nor  the  embedding  signature  is  known  (fully  blind  SS  steganalysis). 
The  only  prior  knowledge  assumed  (or  guessed)  is  the  embedding  (block)  transform  domain.  In 
blind  SS  steganalysis  the  unknown  host  image  acts  as  a  source  of  interference  to  the  message 
to  be  extracted  and,  in  a  way,  the  problem  parallels  blind  digital  signal  separation  applications 
as  they  arise  in  the  helds  of  array  processing  [8]— [12] ,  biomedical  signal  processing  [13],  [14], 
image  reconstruction  [15],  [16]  or  code-division- multiple-access  (CDMA)  wireless  communication 
systems  [17]- [21], 
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From  this  point  of  view,  we  first  develop  a  least-squares-type  iterative  procedure  for  coupled 
signature  estimation  and  message  recovery.  Next,  under  a  (colored)  Gaussian  assumption  on 
the  host  data  bins  we  are  able  to  treat  the  message  signature  as  an  unknown  vector  parameter 
of  a  Gaussian  mixture  and  derive  an  iterative  procedure  for  signature-only  estimation  based  on 
expectation-maximization  (EM)  principles.  Message  recovery  is  then  accomplished  via  minimum- 
mean-square-error  (MMSE)  filtering  and  detection. 

The  rest  of  the  paper  is  organized  as  follows.  In  Section  II  we  present  the  received  signal 
model.  Iterative  procedures  based  on  least  squares  and  EM  concepts  for  signature  identification 
and  message  recovery  are  presented  in  Section  III.  Simulation  results  are  presented  in  Section 
IV.  Finally,  some  conclusions  are  drawn  in  Section  V. 

II.  Signal  Model  and  Notation 

Basic  Notation  and  Terms 

To  understand  and  research  the  problem  of  SS  steganalysis,  it  helps  to  first  put  ourselves  on  the 
side  of  the  SS  steganographer.  Consider  a  host  image  H  G  M,VlXjV2  that  is  to  be  watermarked 
where  A  is  the  image  alphabet  and  N\  x  is  the  image  size  in  pixels.  Fig.  1  shows  a  gray 
scale  F-16  image  example  in  ANixN2  =  {0, 1,  •  •  •  ,  255}512x512.  Without  loss  of  generality,  the 
image  H  is  divided  into  M  local  blocks  of  size  A'lXfjV2  pixels.  Each  block  H^FF,  •  ■  •  .  FF/  is  to 
carry  one  hidden  bit  d(m)  G  {±1},  rn  —  1,2,  ••  •  ,  M,  respectively.  Embedding  is  performed  in 
a  real  2-dimensional  transform  domain  T.  After  transform  calculation  and  conventional  zig-zag 

Ni  xN2 

scanning  vectorization,  we  obtain  T(Hm)  G  M  m  ,  rn  =  1,2,  •••  ,  M.  From  the  transform 
domain  vectors  T(Hm)  we  choose  a  fixed  subset  of  L  <  JVlX/JV2  coefficients  (bins)  to  form  the 
final  host  vectors  xm  G  m  =  1,  2, . . . ,  M  (for  example,  it  is  common  and  appropriate  to 
exclude  the  dc  coefficient). 

An  important  statistical  quantity  for  the  developments  that  follow  is  the  autocorrelation 
matrix  of  the  host  data  x, 

1  M 

R X  =  E  {xxT}  —  ^  xmx^  (1) 

m=  1 
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where  E  {■}  denotes  statistical  expectation  (here  with  respect  to  x  over  the  given  image  H) 
and  T  is  the  transpose  operator.  It  is  easy  to  verify  [6], [7]  that,  in  general,  7^  cR,  c  >  0, 
where  R  is  the  size-L  identity  matrix.  That  is,  RT  is  not  const  ant- value  diagonal  or  “white” 
in  field  language.  As  a  corroborative,  illustrative  example  of  this  assertion,  Fig.  2(a)  shows  the 
familiar  baboon  gray-scale  image  from  standard  image  processing/benchmarking  databases  with 
H  G  {0, 1,  •  •  •  ,  255}256x256;  Fig.  2(b)  shows  the  baboon  host  autocorrelation  matrix  for  block- 
DCT  SS  embedding  of  M  =  1,024  bits  (one  bit  per  8x8  block)  with  L  —  63  (embedding  over 
all  frequency  bins  except  dc). 

In  SS  steganography,  the  message  bit  sequence  {d(m)}^=1  is  hidden  in  the  transform-domain 
host  vectors  {xm}()f=1  via  additive  SS  embedding  by  means  of  a  signature  v  G  ML: 

ym  =  d{m)\  +  x,m  m  =  1, . . . ,  M.  (2) 

At  this  point,  it  is  advantageous  to  change  our  perspective  to  that  of  the  steganalysis  researcher 
attempting  to  recover  the  covert  message.  It  is  reasonable  to  assume  that  {d(m)}^=1  behave  as 
equiprobable  binary  random  variables  that  are  independent  from  each  other  and  {xm}*f=1.  It  is 
also  deemed  reasonable  to  treat  {xm}^=1  as  a  sequence  of  independent  identically  distributed 
random  vectors  with  zero  mean.  Hence,  the  watermarked  data  vectors  {y m}m=i  have  mean 
zero,  autocorrelation  matrix  Ry  =  E  {ymy^}  =  Rx  +  vvr,  and  joint  probability  distribution 
function  (pdf)  /yi,y2,...,yM(yi,  y2,  •  ■  • ,  Ym)  =  /yi(yi)/ya(y2)  •  •  •  /yM(yw)-  The  mean  squared 
distortion  of  the  original  image  due  to  the  hidden  message  is 

V  =  E{\\d(m)v  +  xm  -  xm 1 1 2 }  =  || v|| 2  .  (3) 

Basic  Detection  of  Hidden  Bits 

We  are  interested  in  detecting  the  hidden  bits  {d(m)}^=1  in  (2).  The  linear  filter  that  operates 
on  ym  and  minimizes  the  mean  square  error  (MSE)  at  its  output  is 

wmmse  =  argmimE  j||wTym  -  d(?n)||2|  =  R^v.  (4) 

If  v  were  known,  then  bit  detection  could  be  carried  out  by  sign  detection  at  the  MMSE  filter 
output: 

d{m)  =  sgn  (w^MSEYm)  =  sgn  (vTR^ym)  .  (5) 
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Yet,  v  is  assumed  to  be  unavailable  herein.  In  the  sequel,  we  develop  two  iterative  procedures  for 
signature  estimation  and  message  bit  recovery.  The  first  procedure  is  least  squares  driven  and 
couples  a  signature  estimation  and  a  bit  detection  step.  The  second  procedure  is  derived  from 
the  EM  theory  and  attempts  signature-only  identification;  message  recovery  can  then  be  carried 
out  separately. 

III.  Iterative  Procedures 

Iterative  Generalized  Least  Squares 

For  notational  simplicity  we  form  the  compound  data  observation  matrix 

Y  =  vdT  +  X  (6) 

where  d  =  [d(l)  d{2)  ...  d(M)]T  E  {±1}M  and  X  =  [xix2  ...xM]  E  RLxM .  After  data 
prewhitening,  the  generalized  least  squares  estimator  of  d,  v  is  given  by 

-I  m  2 

arg  min  Rr  2  (Y  —  vdT)  (7) 

veRL,de{±i}M  F 

where  ||-||F  denotes  the  matrix  Frobenius  norm.  Notice  that  if  we  were  allowed  to  assume 
that  (x,n}^f=1  were  Gaussian,  then  (7)  would  coincide  with  maximum  likelihood  (ML)  joint 
estimation  of  d,  v  (treating  both  d  and  v  as  deterministic  unknown  parameters).  In  any  case, 
regretfully,  joint  estimation  of  d,  v  by  (7)  has  complexity  exponential  in  the  hidden  message 
length  M  and  event  the  shortest  of  hidden  messages,  say  100  bits,  makes  the  recovery  task 
practically  impossible.  As  such,  we  consider  this  cost  unacceptable  and  attempt  to  reach  a 
quality  approximation  of  the  solution  by  alternating  least  squares  estimates  of  d,  v  iteratively, 
as  follows: 

1.  Pretend  v  is  known; 

•  Then,  the  least  squares  (LS)  estimate  of  d  is 

_i  2 

dLs  =  arg  min  Rx  2  (Y  —  vd1 )  =  sgn(YTRr  1v).  (8) 

de{±i}M  v  JF 
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(9) 


■  Observing  that  RT  1  v  =  cRy  V,  c  >  0,  we  rewrite 

dLS  =  sgn(YTR“1v) 

and  recognize  that  (9)  represents  MMSE  filtering  followed  by  sign  detection. 

2.  Pretend,  in  turn,  that  d  is  known; 

•  Then  the  least  squares  estimate  of  v  is 

vLS  =  arg  min  R*  2  (Y  —  vdT)  =  Yd.  (10) 

veRL  F  Ivl 

The  conditional  LS  estimate  in  (10)  is  the  best — minimum  variance — unbiased  estimate  of  v  [22], 
The  proposed  algorithm  is  now  straightforward.  Initialize  v  (or  d)  arbitrarily  (or  by  an 
educated  guess  if  side  information  is  available)  and  alternate  iteratively  between  (9)  and  (10) 
to  obtain  at  each  step  conditionally  least  squares  optimal  estimates  of  one  vector  parameter 
given  the  other.  Stop  when  convergence  is  observed.  Notice  that  (9)  requires  knowledge  of 
the  autocorrelation  matrix  of  the  watermarked  host  data  R:y  which  can  be  estimated  by  sample 
averaging  over  the  received  data  observations,  R y(M)  =  77  )Cm=i  YrnYm-  Of  course,  this  way 
the  optimality — in  the  LS  sense — of  (9)  is  obtained  asymptotically,  since  R y(M)  — >  Ry  in 

M— >oo 

probability  for  elliptically  contoured  input  vectors  [23] .  We  call  the  coupled  repeated  calculation 
of  (9)  and  (10)  iterative  generalized  least  squares1  SS  steganalysis  (IGLS-SSS). 

Extensive  experimentation  with  (9)  and  (10)  showed  that  for  sufficiently  long  hidden  messages 
(number  of  bits  M  equal  to  4,000  or  more,  for  example)  high  quality  message  decisions  d  are 
obtained.  When  the  message  size  is  small,  however,  estimation  of  Hy  becomes  problematic 
causing  deviations  of  the  least  squares  estimates  of  d  (and  v)  from  the  true  values.  To  address 
this  concern,  we  have  considered  the  possibility  of  developing  an  expectation-  maximization  (EM) 
signature  identification  procedure  as  a  final-stage  assist. 

Although  in  general  EM  schemes  can  be  computationally  expensive  and  slow  in  convergence, 
meaningful  improvements  for  small  hidden  messages  have  been  achieved,  as  seen  in  [24] ,  and  can 
be  exploited.  In  fact,  in  the  following  section,  we  derive  a  new  expectation-maximization  (EM) 
signature  identification  procedure  to  handle  the  aforementioned  cases. 

1  Occasionally,  conditional  coupled  least-squares  schemes  as  the  one  in  (9)  and  (10)  are  referred  to  as  weighted 
least  squares  [13]  in  the  literature. 
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Expectation-Maximization 

We  are  interested  in  estimating  v  from  the  received  data  vector  y  =  [yf  y[f  •  •  •  y ^-]T  G 

with  pdf  fy( y;v).  To  overcome  the  computational  intractability  of  the  maximum  likelihood 

estimate  of  v,  vml  =  arg  max/y(y;  v),  we  view  the  received  data  y  as  a  set  of  incomplete  data 

veRL 

that  are  part  of  a  larger  postulated  dataset  of  complete  data  [y,  d],  The  pdf  of  the  incomplete 
data  (parameterized  in  v)  is  given  by 

/y(y;v)=  /xd(y>d;v)  (n) 

de{±i}M 

where  /y  d(y,  d;  v)  denotes  the  joint  pdf  of  y,  d  parameterized  in  v.  If  d  were  available,  then  the 

pair  (y,  d)  would  be  a  sufficient  statistic  for  ML  estimation  of  v  by  vML  =  arg  nia x/y  d(y,  d;  v)  = 

veRL 

arg  max{ln/y  d(y,  d;  v)}.  Since  d  is  not  available,  we  may  replace/estimate  ln/yd(y,d;  v)  by  a 
veRL  '  ' 

function,  say  Q(v),  Q(v)  m  ln/y  d(y,  d;  v)  and  maximize  that  estimated  function,  i.e. 

v  =  arg  rnaxQ(v).  (12) 

veRL 

To  proceed  further  we  select  as  Q(v)  the  MMSE  estimate  of  ln/y  d(y,  d;  v)  given  y.  There¬ 
fore,  <5(v)  =  Ed  {ln/yid(y,  d;  v)|y}.  However,  the  conditional  expectation  Ed  {ln/y,d(y,  d;  v)|y} 
includes  the  conditional  pmf  of  the  hidden  data  pd/y(d)  for  all  d  G  {±1}M,  which  in  turn  de¬ 
pends  on  v,  hence  is  not  available.  If  an  estimate  is  available,  it  can  be  used  to  define 
the  conditional  pmf  of  the  hidden  data  parameterized  in  v^k\  pd/y(d;  v^).  Consequently,  our 
estimated  function  (approximation  of  ln/y,d(y,  d;  v))  becomes 

Q(v;  v(fc))  =  Ed  {ln/y)d(y,  d;  v)|y;  v(fc)} 

=  Td/y(d;  v(fc))ln/y,d(y,d;v)  ^ 

de{±i}M 

and  (12)  becomes  v  =  arg  maxQ(v;  v^).  This  v  can  be  used  to  obtain  an  updated  estimate 

veRL 

v(fc+1)  =  arg  max  Q(v;  v(fc)).  (14) 

veRL 

Alternating  calculation  of  (13)  and  (14)  constitutes  an  expectation-maximization  (EM)  pro¬ 
cedure  with  “objective  function”  (as  frequently  referred  to  in  the  literature  [25])  Q(v;  v^).  To 
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proceed  further  toward  a  specific  solution  to  our  steganalysis  (unknown  signature  estimation) 
problem,  we  choose  to  model  the  host  data  vectors  xm  as  Gaussian  distributed,  xm  JV(0,Rx), 
m  —  1,  2, . . . ,  M,  and  therefore 


M 


/y(y;v)  = 

M 


2^(2tt)l\Rx 

|e-(y™-v)TR^1(ym-v)/2  _|_  e-(ym+v)TRy1(ym+v)/2| 


m=  1 


We  rewrite  (13)  as 

2m 

g(v;v(fc))  =  ^pd/y(dp  v(fc))ln/y,d(y,  dp  v) 

i= 1 

where  d,j  G  {±1}M  is  the  ith  possible  message  bit  combination,  i  —  1,2, ,  2M . 
Eliminating  the  constant  over  i  terms  in  the  lefthandside  pdf  of  (16)  we  obtain 


(15) 


(16) 


ln/y,d(y,  dp  v)  =  ln/y/d(y;  v)  +  lnpd(dj)  (17) 

=  vTRj1ymdi(rn)  -  yv2  R^v  +  c, 

m—  1 

where  di(m )  denotes  the  m  — th  element  of  vector  dj  G  {±1}M  and  c±  is  a  constant  that  can  be 
dropped  as  inconsequential  to  the  optimization  problem.  Substituting  (17)  in  (16)  yields 


Q(v;  v») 

2m  r  m 

=X)Wdb  v(fe)K  XXR*ly 

=  X  X  Pd(m)/yM  V(fc))vTR;1ymdG  yV^^V+d. 

m=l(i=±l 


idiim) 


M 


V1  R  1 V  +  Cl  [ 


Let  us  now  calculate  the  conditional  probability 


Pd(m)/ym  (d;  ^) 


fd(m),ym  (d,  ym,  ^) 
/ym(ym;v(fc)) 
fym/d(m){y m,  V(  )) 

Sd=d=i  fym/d(m)  (ym;  v(fc)) 


(18) 


(19) 
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Combining  (18)  and  (19),  (16)  takes  the  closed  form 


n(  .  ~(k))  -  V  Ed=±i/ymMm)(ym;v(fc))vTRa1ym.d 

Ed=±l  fym/d(m)  (y m,  V(*}) 


M  T _ , 

— v  Rx  v  +  Ci 


A  (!  —  g-2v(fc)TRx  Vm) 

“iV  *  Ym  (1  +  e-2ir(fc)TR* lym) 


-y/R^V  +  d 

M 


=vT R  (  1  ^  ym  tanh(v(^,i  Rx  Jy? 


m=l 

M  T__, 

-  yV  R.r  V  +  Cl. 


(20) 


Conveniently,  (20)  is  quadratic  in  v.  To  update  the  estimate  of  v,  we  set  the  derivative  of  (20) 
with  respect  to  v  to  zero  and  obtain  the  recursive  formula 

1  M 

^("'+1)  =  JJ  E  ym  tanh(vWTR;Vm).  (21) 

m=  1 

In  summary,  recursion  (21)  is  the  proposed  EM-type  signature  identification  procedure.  Suc¬ 
cess  of  the  EM  recursion  in  finding  the  global  maximum  depends,  in  general,  on  the  initialization 
vector  v(0).  As  with  the  IGLS  procedure,  Rx  in  (21)  is  substituted  by  R y(M). 


Discussion  on  proposed  blind  IGLS  and  EM  procedures 

It  is  well  understood  that  in  comparison  with  least  squares  algorithms,  EM  procedures  converge 
slowly.  For  the  specifics  of  our  steganalysis  problem  where  the  autocorrelation  matrix  of  the 
host  data  Rx  is  not  available  and  is  substituted  by  the  sample  average  estimate  of  the  received 
data  Ry(M),  we  observed  experimentally  that  the  expected  likelihood  increments  in  (21)  be¬ 
come  exceedingly  small  resulting  in  uncomfortably  slow  convergence  of  the  EM  procedure.  As  a 
result,  we  do  not  consider  the  derived  EM  recursion  as  a  stand-alone  steganalysis  scheme.  We 
rather  suggest  use  of  (21)  as  a  potential  add-on  to  IGLS  for  small-sample-support  steganalysis 
initializing  v(0)  at  vls  from  (9),  (10). 


Finally,  for  the  sake  of  mathematical  accuracy  we  should  emphasize  that  there  is  always  a 
phase/sign  ambiguity  present  when  one  considers  joint  data  demodulation  and  signature  iden¬ 
tification.  The  ambiguity  problem  can  be  overcome  either  under  differential  data  embedding 
or  with  a  few  known  (or  guessed)  embedded  data  symbols  for  phase/sign  correction.  In  the 
following  experimental  studies  the  ambiguity  problem  is  assumed  handled. 

IV.  Experimental  Studies 

We  consider  as  a  host  example  the  familiar  gray  scale  512  x  512  “F-16  Aircraft”  image  that  has 
been  used  widely  in  the  pertinent  literature.  We  perform  8x8  block  DCT  embedding  by  (2)  over 
all  bins  except  the  dc  coefficient  with  an  arbitrary  signature  v  G  M63  and  varying  host  distortion 
V  =  || v || 2 .  The  hidden  message  is,  therefore,  =  4,096  bits  long.  We  examine  four  different 
message  recovery  operations:  (i)  Standard  signature  matched- filtering  (MF)  with  known  v;  (ii) 
MMSE  filtering  with  known  v  and  known  true  autocorrelation  matrix  of  the  host  which 
serves  as  a  performance  bound  reference  for  the  proposed  blind  schemes;  (in)  blind  (neither  v 
nor  is  known)  IGLS  by  (9),  (10);  and  (iv)  blind  IGLS  followed  by  EM  in  (21)  as  derived 
and  discussed  in  Section  3  for  potentially  improved  signature  identification  under  small-sample- 
support  steganalysis.  Fig.  3  shows  the  corresponding  probability  of  error  (bit-error- rate  or  BER) 
curves  as  a  function  of  the  host  distortion.  To  our  satisfaction,  the  proposed  all-blind  schemes 
vastly  outperform  MF  recovery  with  a  known  embedding  signature  and  approach  rather  closely 
the  performance  of  the  ideal  MMSE  detector  where  both  the  embedding  signature  and  the  host 
autocorrelation  matrix  are  perfectly  known2.  It  is  seen  that  for  this  given  message  size  (4,096 
bits)  the  EM  add-on  to  IGLS  offers  a  small  gain  that  arguably  does  not  justify  the  significant 
increase  in  computational  complexity  and  decision  delay. 

In  Fig.  4,  however,  we  repeat  the  exact  same  study  for  the  small  280  x  280  version  of  the 
Aircraft  image.  It  can  now  be  argued  that  for  this  sample  support  (y|r  =  1,225  message  bits) 
the  gain  of  EM  post-processing  (close  to  an  order  of  magnitude  at  30  dB  distortion)  does  justify 

2The  ideal  MMSE  detector  can  be  viewed  as  the  receiver  of  the  intended  recipient  of  the  hidden  message  that 
has  knowledge  of  the  signature  and  the  clean  host. 
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the  extra  cost.  (Fig.  5  shows  the  clean  and  stego  image  after  message  embedding  with  30  dB 
distortion).  For  this  sample  support  =  1,  225  message  bits),  the  gain  of  EM  post-processing 
(close  to  an  order  of  magnitude  at  30  dB  distortion)  is  appealing  but  it  is  expected  that  this 
can  be  improved  if  auxiliary-vector  (AV)  filtering  is  incorporated  either  alone  or  in  conjunction 
with  EM.  For  additional  experimental  verification,  the  same  study  is  carried  out  (Fig.  6)  on  the 
280  x  280  “Lena”  image  with  the  same  conclusions. 

Finally,  Fig.  7  shows  an  example  with  the  ASCII  text  message  hidden  in  Fig.  5(b)  (with  26 
dB  image  distortion)  and  its  recovered  form  by  IGLS  alone  or  IGLS  and  EM  in  tandem. 

V.  Conclusions 

We  considered  the  problem  of  recovering  a  hidden  message  embedded  in  an  unknown  digital 
host  image  by  means  of  an  unknown  signature.  We  first  developed  an  iterative  generalized  least 
squares  (IGLS)  procedure  that  allows  joint  signature  estimation  and  message  recovery.  For  large 
data  support  (i.e.  large  images)  the  hidden  message  can  be  blindly  recovered  with  probability 
of  error  close  to  that  obtained  via  supervised  MMSE  detection.  To  handle  the  cases  of  small 
data  support  (i.e.  small  images)  we  derived  an  expectation- maximization  procedure  that — when 
initialized  appropriately — yields  improved  probability  of  error  rates  when  compared  to  our  first 
proposed  scheme.  Despite  any  difficulties  associated  with  the  estimation  of  the  image  autocor¬ 
relation  matrix  and  the  subsequent  existence  of  fixed  points  that  are  not  global  solutions,  the 
procedures  developed  herein  provide  a  computationally  feasible  alternative  to  complete  enumer¬ 
ation  (for  signature  estimation  and/or  bit  detection). 
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Fig.  1.  F-16  image  example  H  e  {0, 1,  •  •  •  ,  255}512x512 
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(a) 


(b) 

Fig.  2.  Sample  image  manifesting  non-white  autocorrelation  matrix:  (a)  Baboon  image  example 
H  e  {0, 1,  •  •  •  ,  255}256x 256 .  (b)  Host  data  autocorrelation  matrix  (8x8  DCT,  63-bin  host). 
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Fig.  3.  Bit-error-rate  versus  host  distortion  for  the  512  x  512  Aircraft  image. 
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Fig.  4.  Bit-error-rate  versus  host  distortion  for  the  280  x  280  Aircraft  image. 
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Fig.  5.  A  sense  of  distortion:  (a)  Original  280  x  280  plane  image,  (b)  Watermarked  plane  (1.2 
kbit  hidden  message,  L  =  63,  distortion  V  =  30  dB). 
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Fig.  6.  Bit-error-rate  versus  host  distortion  for  the  280  x  280  Lena  image. 
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(a) 

This  is  a  steganalysis  test.  We  test  two  algorithms  for  blind  recovery  of  a  message  and 
its  spreading  code:  iterative  generalized  least  squares  and  expectation  maximization. 

(b) 

This  is  a  steganalysis  test.  We  test  two  algorithms  for  blind  recovery  /fa  mb3sage  and 
its  spreeding  cod%:  it drative! generalized  least  squares  and  expectationOmaximization. 

(c) 

This  is  a  steganalysis  test.  We  test  two  algorithms  for  blind  recovery  of  a  message  and 
its  spreading  cod%2  iterative  generalized  least  squares  and  expectation  maximization. 


Fig.  7.  Covert  messaging:  (a)  Original  hidden  ASCII  message,  (b)  Recovered  ASCII  message 
via  IGLS  coupled  signature  and  binary  message  estimation,  (c)  Recovered  ASCII  message  via 
EM  signature  estimation  (280  x  280  plane  image,  L  =  63,  distortion  T>  =  26  dB). 
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